Mailgun for WordPress Plugin Vulnerable to SSRF Attack: CVE-2026-78003
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- mailgun-for-wordpress (wordpress)
- Patched version
- Not yet available
The Mailgun for WordPress plugin versions up to and including 2.2.0 are under investigation for a critical vulnerability that could allow unauthenticated attackers to make authenticated requests to Mailgun API endpoints, potentially leading to administrator account takeover.
What happened
The Mailgun for WordPress plugin, versions up to and including 2.2.0, is reportedly vulnerable to Server-Side Request Forgery (SSRF) via path traversal. This vulnerability, tracked as CVE-2026-78003, arises from insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'], passing them through sanitize_text_field(). This makes it possible for unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the WordPress site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.
The vulnerability was first flagged on 2026-08-22T09:16:53.543000+00:00. It has a CVSS score of 9.8, indicating a critical severity level. There are no reports of this vulnerability being exploited in the wild at this time. Users of the affected plugin versions should take immediate action to assess their exposure and apply recommended mitigations.
What to do about it
- Upgrade the Mailgun for WordPress plugin to a version beyond 2.2.0.
- Review any inbound email-forwarding routes created through the plugin to ensure they are secure and have not been tampered with.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Consider implementing additional security measures to protect against potential SSRF attacks, such as restricting API access and validating input more rigorously.
How 0Day would have caught this
mailgun-for-wordpress is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Mailgun for WordPress plugin version 2.2.0 or earlier, you are potentially affected by this vulnerability.
What should I do right now?
Immediately upgrade the Mailgun for WordPress plugin to a version beyond 2.2.0 and review any inbound email-forwarding routes created.
Has an official fix been released?
No official fix has been published yet. Monitor the primary sources for updates.
What is the severity of this vulnerability?
The vulnerability has a CVSS score of 9.8, indicating a critical severity level.